forensic bridges classic & classic enhanced family · 2013-07-09 · family of forensic bridges...

AN INTEGRAL COMPONENT OF FORENSIC TOOLKITS

Today’s forensic professionals face an increasingly complex set of data acquisition process

challenges. Acquisition tools must work without failure. As a key component of leading forensic

bridge toolkits or as a standalone product, more forensic professionals rely on Tableau Forensic

Bridges (a.k.a. “write-blockers”) than on any other brand.

FIELD AND LAB DATA ACQUISITION READY

Tableau’s products are at home in both field and lab settings. Pack your kit with Tableau products

and you will be ready for any SCSI, IDE, or SATA acquisition task you encounter. Our products

are easy to use and loaded with standard features, such as Host Protected Area (HPA) and Disk

Configuration Overlay (DCO) recognition.

CONSISTENT LOOK, FEEL, AND OPERATION ACROSS CLASSIC FAMILY PRODUCTS

All Tableau bridges are engineered with a common look, feel, and operation. Consistency across

products guarantees familiarity and eliminates errors as forensic investigators move from one

acquisition to the next. Tableau products are designed for ease of use, insuring that the focus is

on the acquisition process rather than the tools being used.

HIGH PERFORMANCE, GUARANTEED

The T4 offers multiple host interface options through dual FireWire 800, FireWire 400, and USB 2.0

connections. The T35es eSATA model adds eSATA host connectivity. All models share a common

input power supply, eliminating the need for multiple supplies within a forensic kit. Operational

status is easily observed through integrated status LEDs showing: Power, Device Detect, Host

Detect, Write Block, and Device Activity.

MAXIMIZE IMAGING PERFORMANCE WITH TIM SOFTWARE

Tableau’s new software imaging application, TIM (Tableau IMager), delivers amazing HDD

acquisition performance when used with Tableau write blockers. Satisfy your need for speed with

a free version of TIM (v1.0), available at www.tableau.com/TIM.

Copyright © 2010 Tableau, LLC. All rights reserved. Tableau and the Tableau logo are trademarks of Tableau, LLC. FireWire is a trademark

of Apple Computer. Information supplied by Tableau, LLC, is believed to be accurate and reliable at the time of printing, but Tableau, LLC,

assumes no responsibility for any errors that may appear in this document. Tableau, LLC, reserves the right, without notice, to make changes

in product design or specifications. Information is subject to change without notice.

Forensic BridgesClassic & Classic Enhanced Family

Raising the Bar:Tableau Forensic Bridges

Tableau’s forensic bridges (a.k.a. “write-blockers”) are compatible with MS-Windows, Linux, and MAC OS X operating systems. These high-performing, easy to use, and highly reliable products work seamlessly with all popular forensic tools and acquisition methodologies. Each product in the is optimized for a specific I/O interface (see table below).

Designed For

RoHS / W.E.E.ECompiance

Designed For

RoHS / W.E.E.ECompliance

IDE SATA SCSI HOST

T35es ¸ ¸ A, B, C, D T35es-RW ¸ ¸ A, B, C, D T4 ¸ A, B, C

A = FireWire 800B = FireWire 400C = USB 2.0/1.1D = eSATA

T4 SCSI T35es-RW IDE & SATA T35es IDE & SATA

Solutions For The Digital Evidence Lifecycle ®

Tableau, LLC Waukesha, WI 53186 phone: (262) 522-7890 fax: (262) 522-7899 www.tableau.com

USB MASS STORAGE WRITE BLOCKING

The Tableau T8 delivers secure, hardware based write blocking for USB mass storage devices. With

the proliferation of USB mass storage devices, the need for secure USB write blocking has never

been greater. Forensic Examiners rely on the T8 during the acquisition of data from a wide range

of USB 2.0 High Speed, USB 1.1 Full Speed, and USB Low Speed devices.

A WIDE ASSORTMENT OF MASS STORAGE DEVICES

The T8 is optimized for use with products that conform to the USB Mass Storage “Bulk-Only” class

specification. T8’s are being used to acquire data from thumb drives, external USB disk drives, as

well as more exotic storage devices like USB-based cameras and USB-based Apple iPod’s.

FAST AND FLEXIBLE HOST INTERFACE CONNECTIONS

Host connection flexibility is a key design element of Tableau bridges, helping to maximize usability

across multiple host platforms. The T8 supports FireWire 400 and USB 2.0 host interfaces. These

host connection options provide the necessary performance to acquire data from today’s USB-based

devices across a full range of forensic hosts and acquisition software products.

INTEGRATED LCD OPERATIONAL DISPLAY

In today’s forensic bridge market, the T8 stands alone. The T8’s innovative LCD functions as the

information center for bridging activities and devices. Using the two convenient operator buttons,

the user can progress through a variety of menu displays to view vital device and acquisition

information. The monochrome LCD features 2 rows of 16 characters that are used to display status

information, detailed technical information obtained from the attached USB device, as well as key

information about the T8 bridge itself. Easy to use, easy to read, and highly informative, the T8

forensic bridge continues the heritage of Tableau technology innovation.









Designed For


Designed For


T8 USB Bridge



Thinking Outside of the Box

Tableau launched the Innovation Family of forensic bridges (a.k.a. “write blockers”) with the creation of the T8, the industry standard for USB device bridging. The T8 combines the ergonomics and reliable operation of other Tableau forensic bridge products with the innovative use of an integrated LCD interface, the first of its kind for forensic bridges.

T8 Forensic USB BridgeInnovation Family

THE TABLEAU T9 - THE FIRST PORTABLE FIREWIRE HARDWARE WRITE BLOCKER

The Tableau T9 solves the growing challenge of imaging FireWire hard drives and Apple Macintosh®

computer systems in a forensically sound manner. Built with similar operational features as our

popular T8 USB bridge, the T9 enables reliable and efficient data acquisition in both field and lab

environments.

ACQUIRE DATA FROM FIREWIRE STORAGE AND APPLE MACINTOSH COMPUTERS

Imaging FireWire storage devices, including Apple Macintosh® computers, has always presented

a special challenge to forensic examiners. The T9 supports full multi-LUN (Logical Unit Number)

write-blocked acquisitions of FireWire storage devices (including Macintosh computers booted

in target-disk mode). The T9 identifies multiple LUNs present and prompts the user to select the

appropriate LUN for imaging. The ability to image without the need to remove hard drives means

you will work faster, more effectively, and with less risk of damage to evidence.

INTEGRATED LCD OPERATIONAL DISPLAY

The T9’s innovative LCD functions as the information center for storage device and write-blocker

information. Using the two convenient operator buttons, the user progresses through a variety of

menu displays to view vital information. The monochrome LCD features 2 rows of 16 characters

that are used to display status information, detailed technical information obtained from the

attached FireWire device, as well as key information about the T9 bridge itself. Easy to use, easy to

read, and highly informative, the T9 maintains Tableau’s heritage of innovation.









T9 Forensic FireWire BridgeInnovation Family

The T9: Another Tableau First

The T9 Forensic FireWire Bridge is the Forensic Industry’s first portable FireWire write-blocker. The T9 features FireWire 800/400 and USB host connections, an integrated LCD, and six LEDs for visual status. Intelligent and efficient to use, this write-blocker deserves a place in your forensic toolkit.

Designed For


Designed For




ENGINEERED - IN PRODUCT QUALITY, PERFORMANCE, AND VALUETableau engineers its OEM forensic bridges (a.k.a. “write-blockers”) to be high-performance, integral components in today’s forensic workstations. Our OEM bridges provide forensic professionals with the power to image IDE, SATA, SCSI, USB, and FireWire devices. Tableau’s customer support and ongoing program of free, easy to apply firmware updates protect your original investment long after the sale.

T34589is - THE NEW STANDARD IN COMBINATION WRITE-BLOCKERSThe T34589is (a.k.a. Digital Intelligence UltraBay II) allows examiners to use one write-blocker for IDE, SATA, SCSI, USB, and FireWire imaging. In addition to the industry’s first FireWire hardware write-blocker, the T34589is includes an LCD user interface and a front panel FireWire/USB hub. The FireWire section of this product may be used to image Apple Macintosh® computers that are booted in target disk mode. TABSense™, Tableau’s proprietary dual SATA and FireWire host

interface, automatically selects the best fit channel for data transfer.

T3458is - FLEXIBILITY AND HIGH PERFORMANCE IN A SINGLE PACKAGEThe T3458is supports write-blocked acquisitions of IDE, SATA, SCSI, and USB storage devices from a convenient half-height drive bay mountable package. Built with TABSenseTM, the T3458is

manages the host interface for efficient data transfers and easy, hassle-free firmware updates.

T335, AND T35i - RELIABLE, ACQUISITION TESTED PRODUCTSWhatever your acquisition and system requirement, Tableau has a proven OEM write-blocker that will meet your need. The T35i (IDE/SATA) offers front-panel access to write-blocked connections. Up to three drive bays (two SATA, one IDE) can be write-blocked using the T335. Both products support fast, hot-swappable FireWire 800 host connections.









OEM Family Forensic Bridges

Designed for High Performance Forensic Workstations

Forensic practitioners require their lab workstations to offer a unique combination of speed, flexibility, reliability, and comprehensive imaging capability. Whether you are purchasing a pre-configured forensic workstation or building your own, there is a Tableau OEM family write-blocker designed to meet your needs.

Designed For


Designed For


IDE SATA SCSI USB FW

T34589is ¸ ̧ ̧ ̧ ̧T3458is ¸ ̧ ̧ ̧T35i ¸ ¸

T335 ¸ 2¸

T35i SATA/IDE T335 SATA(2)/IDE

T34589is IDE/SATA/SCSI/USB/FireWire T3458is IDE/SATA/SCSI/USB



TABLEAU TD1 - INDUSTRY LEADING FEATURES, PERFORMANCE & VALUE

Engineered and built to the same quality, durability, and performance standards as Tableau’s

write-blockers and hardware accelerators, the TD1 Forensic Duplicator is an intelligent

alternative to higher-priced disk imaging solutions. The TD1 supports hashed (SHA-1 &

MD5) duplication of IDE or SATA HDD’s at sustained transfer speeds of up to 6 GBytes per

minute.

EASY ONE-BUTTON DUPLICATION

TD1 is designed for easy, one-button operation. Upon source and destination drive connection

and power-up, TD1 will verify drive and device information. To start duplication, simply push

the TD1 enter button. Imaging will begin based upon the TD1 user presets entered during

initial device setup. Or if you prefer, use the TD1 control keys and LCD to select from a menu

of available TD1 functions. Once duplication begins, progress information is displayed on

the 80 character LCD. A complete list of product features, specs, and access to the TD1 User

Guide can be found at www.tableau.com/products/td1.

SATA OR IDE DISK-TO-DISK AND DISK-TO-FILE DUPLICATION

The TD1 provides the flexibility of cloning

(disk-to-disk) or imaging (disk-to-FAT32 file

system) hard drives. Source and destination drives

may be any combination of SATA or IDE. TD1

supports 1:1 drive duplication and will prompt

users when spaning multiple destination drives.

MORE DUPLICATOR FOR THE MONEY

In addition to fast drive duplication, user

selectable functions include FAT32 Disk

Formatting, Disk Wiping, Disk Blank Check,

Display Disk Information, Hash Disk Drives (MD5

or SHA-1), View & Print Logs, and Setup Device Information. The TD1 ships ready for use

with all items shown at left.

As with all Tableau products, the TD1 recognizes and defeats HPA and DCO protected disk

regions. A FireWire connection is provided for fast firmware updates.

Right-priced at $1249 USD, the TD1 is available September 1, 2008 through all Authorized

Tableau Resellers.





Tableau, LLC N8 W22195 Johnson Drive, Suite 100Waukesha, WI 53186 phone: (262) 522-7890 fax: (262) 522-7899 www.tableau.com

TD1 Forensic DuplicatorProduct Brief

Designed For


Designed For


Solutions For The Digital Evidence Lifecycle®

TD1 top view

TD1 destination side view

TD1 source side view

TD1 showng FireWire & USB (2x) connectors

The TD1 Forensic Duplicator ships with:

s TD1 Forensic Duplicator

s TP3 High Outpout Power Supply

s TC2-8 Molex Power Cable (2x)

s TC6-8 IDE Signal Cable (2x)

s TC3-8 SATA Signal Cable (2x)

s TC5-8 Molex/SATA Power Cable (2x)

s TC6-2 2” IDE Signal Cable

s TDA5-18 1.8” Drive Adapter

s TDA5-25 2.5” Drive Adapter

s TDA5-ZIF Drive Adapter

HARDWARE ACCELERATOR REDUCES DICTIONARY BASED RECOVERY TIMES

Tableau’s TACC1441 is the proven standard for hardware accelerated password

recovery. TACC1441 works with password recovery solutions from AccessData

(PRTK & DNA) and Passware (Forensic Kit v9.5) to dramatically increase the

performance of dictionary-based attacks. Built to scale easily and with a low

power consumption footprint, TACC1441 is available in desktop and bay-mount

products.

BENCHMARK TESTS SHOW SIGNIFICANT PERFORMANCE GAINS

The charts at left demonstrate the power of the Tableau TACC. One TACC1441 unit

(with 16 Field Programmable Gate Arrays, or “FPGAs”) connected to various host

computer systems yielded unprecedented performance gains of 6x to 30x (versus

systems with no acceleration).

Need to shorten recovery times even more? Connecting multiple hardware

accelerators together (daisy chained via FireWire 800) results in linearly

increasing performance.

RE-SHAPING PASSWORD ATTACKS WITH THE TABLEAU ACCELERATOR

As shown in the diagram at left, complex mathematical processing is performed

by the specialized vector processing capabilities of the TACC. With the host system

freed of this complex computational processing, password recovery performance

of the overall system is significantly improved. With TACC acceleration, fewer

dedicated computer systems will be required for your decryption needs. This

saves you time and money.

SUPPORT FOR OFFICE 2007 AES128 ENCRYPTION

Office2007’s AES 128-bit encryption mandates the need for dictionary-based

attacks. TACC accelerates the decryption of Office 2007 files and more. Please visit

the TACC product page (www.tableau.com/tacc) for additional product details,

including an up-to-date list of algorithms supported and overall performance.





TACC1441 Accelerator for Password Recovery

TACC1441 On-Board Vector Processing

AlgorithmSpecific

Transforms

First-LevelPasswordValidation

SuspectDictionary

StandardDictionary

TrialPasswordGenerator

TACC1441 API(Application

Programming Interface)

2nd LevelPassword

Decryption

Host Computer Processing

Success !

Passwords per Second vs.

# of Tableau Accelerators

0

50,000

100,000

150,000

200,000

250,000

300,000

1 2 3 4

Number of TACC1441 Hardware Accelerators

(connected to a single Core™2 Quad 2.40GHz host)

Pw

d/S

ec

WinZip9 PGP Disk v4 PGP Disk v6 Cast128 PGP Disk v6 AES256 PGP SDA WinRAR


Computing Platform

0 10,000 20,000 30,000 40,000 50,000 60,000 70,000

WinZip9

PGP Disk v4

PGP Disk v6 Cast128

PGP Disk v6 AES256

PGP SDA

WinRAR

Pwd/Sec

Pentium 4 - 3.8GHz Core™2 Quad - 2.40GHz Quad + TACC1441



Designed For


Designed For


Seizure &Discovery

Acquisition Analysis DataMining

ArchivalStorage

Solutions for the Digital Evidence Lifecycle®

Breakthrough PerformanceTableau’s TACC1441 sets the new standard in password recovery performance. Working inconjunction with software from the established leader in password recovery, AccessData, Tableau’s TACC1441 delivers unprecedented password attackrates.

The chart at the rightgraphs passwords-per-secondwhen running AccessData’s PRTK(Password Recovery Toolkit) onthree different platforms: acommon Pentium IV, a brand-new Intel Core2 Quadcore, and the same Quadcore with one TACC1441 accelerator.

WinRAR, PGP, and WinZip arewidely used file formats which present enormous challenges for password recovery software running on traditional processing platforms. As the chart shows, the TACC1441 accelerates each of these algorithms by a factorof 6x - 30x compared to the un-accelerated processors. And that’s just one TACC1441...Several TACC1441 units can be connected to a single host to boost performance even further!

Accelerated Password Recovery

Tableau TACC1441 Hardware Accelerator


Computing Platform

0 10,000 20,000 30,000 40,000 50,000 60,000 70,000

WinZip9

PGP Disk v4

PGP Disk v6 Cast128

PGP Disk v6 AES256

PGP SDA

WinRAR

Pwd/Sec

Pentium 4 - 3.8GHz Core™2 Quad - 2.40GHz Quad + TACC1441


# of Tableau Accelerators

0

50,000

100,000

150,000

200,000

250,000

300,000

1 2 3 4

Number of TACC1441 Hardware Accelerators

(connected to a single Core™2 Quad 2.40GHz host)

Pw

d/S

ec

WinZip9 PGP Disk v4 PGP Disk v6 Cast128 PGP Disk v6 AES256 PGP SDA WinRAR

Seizure &Discovery

Acquisition Analysis DataMining

ArchivalStorage

Solutions for the Digital Evidence Lifecycle®

Need Faster Performance? Use Multiple Accelerators!Do you need even faster performance than the 6x - 30x gain offered by a single TACC1441?If so, you can gang multiple TACC1441 accelerators together on a single computer!

The chart at the right illustratesthe benefit of using multipleTableau TACC1441 accelerators with a single host computer, in this case, a Pentium Core2 Quadcore.

For each additional TACC1441unit there is roughly a linearincrease in performance for manywidely used encrypted file formats, such as WinZip and PGP.In certain cases, the benefits extend even to file formats likeWinRAR!

If you are familiar with dictionary-based password attacks like WinZip, you are accustomed to seeing rates of 1,000 - 3,000 passwords per second on Pentium IV computers, maybe 20k+passwords per second on a mid-size AccessData DNA cluster. Today we have single CPUs withfour TACC1441 accelerators running in excess of 250,000 passwords per second!

Scaling Password Recovery

Tableau TACC1441 Hardware Accelerator

forensic bridges classic & classic enhanced family · 2013-07-09 · family of forensic bridges...

Documents